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Abstract In this paper we propose an extension of Defeasible Logic to represent 
and compute three concepts of defeasible permission. In particular, we discuss dif- 
ferent types of explicit permissive norms that work as exceptions to opposite obli- 
gations. Moreover, we show how strong permissions can be represented both with, 
and without introducing a new consequence relation for inferring conclusions from 
explicit permissive norms. Finally, we illustrate how a preference operator appli- 
cable to contrary-to-duty obligations can be combined with a new operator repre- 
senting ordered sequences of strong permissions which derogate from prohibitions. 
The logical system is studied from a computational standpoint and is shown to have 
liner computational complexity. 



1. Introduction 

The concept of permission plays an important role in many normative domains in that 
it may be crucial in characterising notions such as those of authorisation and derogation 
111 11301331 . For example, sometimes it may happen that we mistakenly drive to a building 
site, or a road-work restricted area, with signs out saying "No admittance. Authorised 
personnel only". Or consider when we subscribe to an on-line sale agreement accepting 
to enter our personal data on the condition that this information is only used for shipping, 
and other necessary purposes to communicate with us or deliver the products to us. In 
both cases, a permission (to enter a restricted area or to use our personal data) is stated 
as an exception to a general prohibition. 

Despite this fact, the concept of permission is still elusive in this field of literature 
and has not been extensively investigated in deontic logic as the notion of obligation. 
For a long time, deontic logicians mostly viewed permission as the dual of obligation: 
Pa = — iO— 1<3. This view is unsatisfactory, as it hardly allows us to grasp the meaning of 
examples like the ones previously mentioned. For this, and other reasons, the attempt to 
reduce permissions to duals of obligations has been criticised (see 112111 ). 

One important distinction that has traditionally contributed to a richer account of 
this concept is the one between weak (or negative) and strong (or positive) permission 
11351 . The former corresponds to saying that some a is permitted if -« is not provable 
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as mandatory. In other words, something is allowed by a code iff(only when) it is not 
prohibited by that code. At least when dealing with unconditional obligations, the notion 
of weak permission is trivially equivalent to the dual of obligation l25l . 

The latter concept of strong permission is more complicated, as it amounts to saying 
that some a is permitted by a code iff such a code explicitly states that a is permitted. 
It follows that a strong permission is not derived from the absence a prohibition, but 
is explicitly formulated in a permissive norm. The complexities of this concept depend 
on the fact that, besides "the items that a code explicitly pronounces to be permitted, 
there are others that in some sense follow from the explicit ones". The problem is hence 
"to clarify the inference from one to the other" ll25l p. 391-2]. For example, if some b 
logically follows from a, which is strongly permitted, can we say that b is also strongly 
permitted? 

Features such as the distinction between strong and weak permission show the multi- 
faceted nature of permission and permissive norms, which has been overlooked by most 
logicians for a long time. Nevertheless, some exceptions have recently offered signifi- 
cant contributions to the logical understanding of permission 125 9 1101121331321 . These 
contributions can be roughly summarised into the following points: 

• despite some scepticism H28I27I and critical remarks H3I2I (a discussion of this re- 
lated work can be found in Section |7), the distinction between weak and strong per- 
mission seems to be needed, otherwise it is rather hard to account for the fact that 
certain permissions make sense because they explicitly derogate to existing prohibi- 
tions while other permissions are not explicit and occur precisely because opposite 
prohibitions do not exist; 

• we may have different types of strong permissions (specifically permissions that 
logically follow from explicit permissive norms), according to whether 

* we statically determine what is actually permitted given what is obligatory and 
what is explicitly permitted; 

* we dynamically determine "the limits on what may be prohibited without vio- 
lating static permissions" (9); 

• especially in the law, strong permissions state exceptions to obligations |8}: indeed, 
derogating with a permission, for example, to a general prohibition to use private 
protected data provides an exception to such a prohibition; 

• strong permissions make sense even when any incompatible prohibitions are not in 
the legal system; permissions have a dynamic behaviour and prevent future prohibi- 
tions from holding in general, or applying to specific contexts lfl3l . 

This paper moves from the above points with the specific purpose of studying the 
different conceptual and computational aspects of weak and strong permissions. More 
precisely, the current contribution works in the following directions: 

Permissions and defeasibility. The concept of permission exhibits strong connections 
with the idea of defeasibility. Indeed, an example of a natural way to capture strong 
permissions acting as exceptions to obligations is the one where permissions rebut 
the conclusions of incompatible prescriptive norms 1125191 171331 or undercut them 
(i.e., challenge an inference rule of an argument supporting an opposite obligation) 

My 
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Permissions and preferences. Sometimes explicit derogations of (existing or possible) 
prohibitions can be ranked according to some preference orderings. In other words, 
given any prescriptive norm prohibiting a, more derogations to this norm can be 
stated and ranked in a certain preference sequence. This situation may occur in do- 
mains such as the law, where for instance the lawmaker, when imposing duties for 
citizens, establishes conditions to lessen the effect of violating such duties to differ- 
ent degrees, or exempt people to comply with the duties. We will study these mech- 
anisms and see that ordered sequences of strong permissions, derogating or making 
exceptions to prohibitions, have interesting similarities with ordered sequences of 
contrary-to-duty obligations 1141151 . This is a specific novelty of our contribution, 
as such sequences regard permissions (i.e., exceptions) which are not necessarily 
incompatible with each other. 

Permissions and computation. If, as we have mentioned, the concept of permission is 
mostly overlooked in literature, being that its computational treatment is basically 
neglected. To the best of our knowledge, no work in deontic logic has extensively 
explored the computational complexity of reasoning about different types of per- 
mission. Here, we will attempt a first analysis of the problem in the context of a 
modal extension of Defeasible Logic 0. Modal Defeasible Logic is a computation- 
ally efficient logical framework able to capture various aspects of non-monotonic 
and modal reasoning, as well as the defeasible character of permissive norms, and 
recently a possible- world semantics for it has been proposed [ 18 1. We will study how 
to compute weak and strong permissions with and without introducing a new non- 
monotonic consequence relation for permission. The choice of Defeasible Logic is 
motivated by the fact that it is very efficient. Also, the formal language of its (non- 
modal) modulo is simple, thus allowing us to isolate the deontic aspects of permis- 
sions and investigate their specific computational characteristics. 

The layout of the paper is as follows. Section|2]introduces and informally discusses 
three types of defeasible permission in Defeasible Logic. Section[3]presents the techni- 
cal machinery and states coherency and consistency results of the proposed extension. 
In Section H] we develop the algorithmic means to state what is mandatory and what is 
permitted in a given theory, along with the corresponding computational results in Sec- 
tion |5] Section [6] discusses the system and illustrates how the logical framework pre- 
sented in Section|3]is able to capture the three types of permission. Section[7]discusses 
some related work and provides a summary of the paper. 



2. Three concepts of permission 

This section is meant to offer a brief and gentle introduction to our formal language 
and logic, and to discuss three different types of permission and their relation with the 
concept of normative defeasibility. Moreover, we illustrate the idea of preference over 
permissions that explicitly derogate to prohibitions. 

These aspects will be formally handled in Section [3] The whole discussion of the 
computational aspects of permission in Defeasible Logic is postponed to Sections [4] and 

13 
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2.1. Informal presentation of the logic 

Let us summarise the basic logical intuitions behind our framework. 

1. Permissive and prescriptive norms are represented by means of defeasible rules, 
whose conclusions normally follow unless they are defeated by contrary evidence. 
For example, the rule 

Order =>o Pay 

says that, if we send a purchase order, then we will be defeasibly obliged to pay; the 
rule 

Order, Creditor =>p ->Pay 

states that if we send an order, in general we are not obliged to pay if we are creditors 
towards the vendor for the same amount. 

2. Rules introduce modalities: if we have the rule a =>o b and a holds, then we obtain 
Ob. That is to say, in the scenario where conditions described by a hold, the obli- 
gation of doing b is active as well. The advantage is that explicitly deriving modal 
literals such as Ob adds expressive power to the language, since Ob may appear in 
the antecedent of other rules, which can then be triggered. 

3. For the sake of simplicity, modal literals can only occur in the antecedent of rules. 
In other words, we do not admit nested modalities, i.e., rules such as a =>o Pb. This 
is in line with our idea that the applicability of rules labeled with modality □ (where 
□ can be O for obligation or P for permission) is the condition for deriving literals 
modalised with □. 

4. The symbols O and P are not simple labels: they are modalities. O is non-reflexiv43: 
consequently, we do not have a conflict within the theory when -ia is the case and 
we derive that a is mandatory (Oa); this amounts to having a violation. The modality 
P works in such a way that two rules for P supporting a and ->a do not clash, but a 
rule like =>p b attacks a rule such as =>o ~^b (and vice versa). 

5. Like standard Defeasible Logic, our extension is able to establish the relative 
strength of any rule (thus to solve rule conflicts) and has two types of attackable 
rules: defeasible rules and defeaters. Defeaters in Defeasible Logic are a special kind 
of rules: they are used to prevent conclusions but not to support them. For example, 
the def eater 

SpecialOrder,PremiumCustomer ~~>o ~^PayBy7Days 

can prevent the derivation of the obligation for premium customers placing special 
orders to pay within the deadline of 7 days, but cannot be used to directly derive any 
conclusion. 

2.2. Permissions and defeasibility 

The above framework, though simple, allows us to express three basic types of permis- 
sions as well as illustrate interesting connections with the idea of defeasibility. 



As it is well-known, in a non-reflexive modal logic Da does not imply a, where □ is a modal operator. 
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Weak permission. A first way to define permissions in Defeasible Logic is by simply 
considering weak permissions and stating that the opposite of what is permitted is not 
provable as obligatory. Let us consider a normative system consisting of the following 
two rules: 

r\ : Park, Vehicle =>o "'Enter 

r2 '■ Park, Emergency =>o Enter. 
Here the normative system does not contain any permissive norm. However, since Defea- 
sible Logic is a sceptical non-monotonic logic, in case both r\ and r2 fire we neither con- 
clude that it is prohibited nor that it is obligatory to enter, because we do not know which 
rule is stronger. Hence, in this context, both -^Enter and Enter are weakly permitted. 

As already argued, this is the most direct way to define the idea of weak permission: 
some q is permitted by a code iff q is not prohibited by that code. Accordingly, saying 
that any literal q is weakly permitted corresponds to the failure of deriving -*q using rules 
for O. Notice that, in Defeasible Logic, this does not amount to obtain -O-iq. 

Explicit permissions are defeaters. In Defeasible Logic any rule can be used to prevent 
the derivation of a conclusion. For instance, suppose there exists a norm that prohibits to 
U-turn at traffic lights unless there is a "U-turn permitted" sign: 

r\ : AtTrafficLight =>o ~^Uturn 

r2 : AtTrafficLight, UturnSign =>o Uturn. 

In this example we use a defeasible rule for obligation to block the prohibition to U-turn. 
However, this is not satisfactory: if we do not know whether r2 is stronger than r\, then 
the best we can say is that U-turn is weakly permitted. Furthermore, if r2 prevails over 
7*1, we derive that U-turn is obligatory. 

Thus, there are good reasons to argue that defeaters for O are suitable to express 
an idea of strong permissior0. Explicit rules such as r : a ~~>r> q state that a is a specific 
reason for blocking the derivation of O^q (but not for proving Oq). In other words, 
this rule does not support any conclusion, but states that -<q is deontically undesirable. 
Consider this example: 

r\ : Weekend ,AirPollution =>o -<UseCar 
r2 : Weekend, Emergency UseCar. 

Rule r\ states that on weekends it is forbidden to use private cars if a certain air pollution 
level is exceeded. Defeater r2 is in fact an exception to r\, and so it seems to capture the 
above idea that explicit permissive norms (especially in the law) provide exceptions to 
obligations. 

Explicit permissions using permissive rules. Another approach is based on introducing 
specific rules for deriving permissions 1125191 . Let us consider the following situation: 

r\ : Weekend, AirPollution =>o "'UseCar 
r' 2 : Emergency =>p UseCar. 

As r2 in the previous scenario, r' 2 looks like an exception to r\ . The apparent difference 
between r2 and r' 2 is that the latter is directly used to prove that the use of the car is 
permitted (PUseCar) in case of emergencies. The question is: does it amount to a real 
difference? 

2 The idea of using defeaters to introduce permissions was introduced in 1191 . 
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Although r2 is a defeater, it is specifically used to derive the strong permission to 
use the car, like r' 2 . In addition, rules such as r' 2 do not attack other permissive rules, but 
are in conflict only with rules for obligation intended to prove the opposite conclusion. 
This precisely holds for defeaters. 

Moreover, let us suppose to have the defeater s : a b. Does s attack a rule like 
=h> -bl 

If this is the case, s would be close to an obligation. The fact that Pb does not attack 
P-ib makes it pointless for s to introduce defeaters for P. But, if this is not the case, s 
could only attack =>o ~^b, thus being equivalent to s' : a b. 

Therefore, although it is admissible to have defeaters, we do not need to distinguish 
defeaters for O from those for P. One way to mark the difference between ~» and =>p is 
by stating that only the latter rule type admits ordered sequences of strong permissions 
in the head of a rule, which are supposed to derogate or make exceptions to prohibitions. 
This matter will be discussed in the next subsection. 

2.3. Permissions, obligations, and preferences 

The introduction of ordered sequences of strong permissions in the head of a rule, which 
derogate or make exceptions to prohibitions, can be logically modelled by enriching the 
formal language and following these guidelines: 

1. In many domains, such as the law, norms often specify mandatory actions to be 
taken in case of their violation. In general, obligations in force after the violation 
of some other obligations correspond to contrary-to-duty (CTD) obligations. These 
constructions affect the formal characterisation of compliance since they identify 
situations that are not ideal, but still acceptable. A compact representation of CTDs 
may resort to the non-boolean connective ® lfl4l : a formula like x =>o a®b means 
that, if x is the case, then a is obligatory, but if the obligation a is not fulfilled, then 
the obligation b is activated and becomes in force until it is satisfied, or violated. 

2. Concepts introduced at point Q] can be extended to permissive rules with the sub- 
scripted arrow =>p by introducing the non-boolean connective for sequences of 
permissions. As in the case of (g), given a rule like =>p a © b, we can proceed through 
the ©-chain to obtain the derivation of Pb. However, permissions cannot be violated, 
and consequently it does not make sense to obtain Pb from =>p a b and -ia. In this 
case, the reason to proceed in the chain is rather that the normative system allows us 
to prove O-ia. Hence, still establishes a preference order among strong permis- 
sions and, in case the opposite obligation is in force, another permission holds. This 
is significant especially when strong permissions are exceptions to obligations. 

In this paper we take a neutral approach as to whether ordered sequences of obliga- 
tions or permissions are either given explicitly, or inferred from other rules. However, we 
point out that normative documents often explicitly contains provision with such struc- 
tures. A clear example of this is provided by the Australian "National Consumer Credit 
Protection Act 2009" (Act No. 134 of 2009) which is structured in such a way that for 
every section establishing an obligation or a prohibition, the penalties for violating the 
provision are given in the section itself. 

Example 1 (National Consumer Credit Protection Act 2009). Section 29 (Prohibition 
on engaging in credit activities without a licence) of the act recites: 
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(1) A person must not engage in a credit activity if the person does not hold a licence 
authorising the person to engage in the credit activity. 
Civil penalty: 2,000 penalty units. 
[...] 

Criminal penalty: 200 penalty units, or 2 years imprisonment, or both. 

This norm can be represented as 

r\ :=>o ~<CreditActivity®2000CivilPenaltyUnits 

ri : CreditLicence =>p CreditActivity 

where ri > r\. The first rules state that in absence of other information a person is for- 
bidden to engage in credit activities (0->Credu Activity), and then the second rule estab- 
lish an exception to the prohibition, or in other terms it recites a condition under which 
such activities are permitted. The section then continues by giving explicit exceptions 
(permissions) to the prohibition to engage in credit activity, even without a valid licence. 

Sequences of permissions are a natural fit for expressions like "the subject is autho- 
rised, in order of preference, to do the following: (list)" or "the subject is entitled, in order 
of preference, to one of the following: (list)". This is illustrated in the next example. 

Example 2 (U.S. Copyright Act). A concrete instance of sequences of permissions is 
given by Section 504(c)(1) (Remedies for infringement: Damages and profits) of the U.S. 
Copyright Act (17 USC §504). 

Except as provided by clause (2) of this subsection, the copyright owner may elect, at 
any time before final judgment is rendered, to recover, instead of actual damages and 
profits, an award of statutory damages for all infringements involved in the action, 
with respect to any one work, for which any one infringer is liable individually, or 
for which any two or more infringers are liable jointly and severally, in a sum of not 
less than $750 or more than $30,000 as the court considers just. [. . . ] 

The above provision can be modelled as 

infringment, before Judgment =>p ActualDamages Statutory Damages 

The above rendering of the textual provision is based on the interpretation of the term 
'instead', which suggests that the copyright owners are entitled by default the award of 
the actual damages and profits, but they may elect to recover statutory damages, which 
is then the second option if exercised by the relevant party^ 

As we have just seen, chains of obligations are appropriate to capture the obligations 
and the penalties related to them. Furthermore, this kind of structure has been success- 
fully used for applications in the area of business process compliance ||2T1 . In a situation 
governed by the rule =>o a®b and where ->a and b hold, the norm has been complied 
with (even if to a lower degree than if we had a). On the contrary, if we had two rules 
=>o a and -ia =>o b, then the first norm would have been violated, while the second 
would have been complied with. But in overall, the whole case would be not compliant 

ma. 

3 Here we speak of entitlements or rights. A right is a permission on one party (in this case the copyright 
owner) generating an obligation on another party (in this case the infringer). For a more detailed discussion on 
the concept of right see 1301 . 
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Consider the following example: 

ri : Invoice =>o PayWithin7days 

7"2 : OPayWithin7days, ^PayWithin7days =>o Pay5%Interest 
r$ : QPay5%Interest ; ^Pay5%Interest =>o PaylO%Interest. 

What happens if a customer violates both the obligation to pay within 7 days after the 
invoice and the obligation to pay the 5% of interest, but she pays the total amount plus the 
10% of interest? In the legal perspective the customer should be still compliant, but in this 
representation contract clauses r\ and ri have been violated. However, if we represent 
the whole scenario with the single rule 

Invoice =>o PayBy7days®Pay5%Interest®PaylO%Interest, 

then the rule is not violated, and the customer is compliant with the contract. 

Even when the text of legal provisions does not explicitly have this form, there are 
cases where the joint interpretation of several legal provisions still leads to formulate 
applicable norms with orders among derogations. 

Example 3 (Formal equality and affirmative action). Art. 3, 1st paragraph, of the Italian 
constitution ensures formal equality of citizens (in fact, all individuals) before the law, 
namely, an equal legal treatment for everybody: 

All citizens have equal social dignity and are equal before the law, without distinction 
of sex, race, language, religion, political opinion, personal and social conditions. 
[...] 

This general principle can be sometimes derogated, for example, when derogations are 
meant "to remove those obstacles of an economic or social nature which constrain the 
freedom and equality of citizens" (art. 3, 2nd par). In fact, one may argue that permit- 
ting (which is different from imposing as mandatory) the adoption of affirmative action 
policies in favour of women (e.g., introducing quotas for women in politics and the job 
market) is a flexible legal measure to remove some of those obstacles. Now, suppose a 
quota for women is guaranteed in public institutions in hiring and promoting employ- 
ees, but another similar derogation can be applied to disabled people. Imagine that, in 
a specific case, it is not possible to apply both derogations (for example, this would lead 
to exceeding the number of jobs available) and so we have to choose to hire a woman 
or a disabled man. In absence of any further legal provision, one possible solution is to 
balance both options with respect to the specific facts X of the case, thus ranking, in a 
rule r, these options in order of preference, given the facts X (on balancing, see H4\311l ). 
For instance, if disabled men should be favoured over non-disabled women (because dis- 
ability in this case reinforces a more serious discrimination or disadvantage) then r is 
the following: 

r : X =>p Hire -Disabled -Men Hire -NonDisabled -Women 

The reason why we should still keep as a second option Hire -NonDisabled .Women de- 
pends on the fact that we can draw only defeasibly the permission of Hire -Disabled -Men. 
Indeed, we have only considered art. 3 of the Italian constitution but other legal pro- 
visions or factual reasons could block this conclusion. For example, suppose that the 
disabled person applying for the job was some years earlier convicted of the crime of 
belonging to a mafia organisation, while the law prohibits in general and without excep- 
tions for public institutions to hire people who committed that crime. Or imagine that, 
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in the meantime, the disabled man has withdrawn his request for a job. In both cases, 
despite X occurs, the first option does not hold and, all things considered, the second one 
can be applied in order to derogate to art. 3, 1st par., of the Italian constitution. 

3. Defeasible Deontic Logic with strong permission 

This section begins by introducing the language adopted to formalise obligations and 
strong permissions in DL, and describing the inferential mechanism in the form of proof 
conditions defining the logic. Finally, we show that the proposed formalisation enjoys 
properties appropriate to model the notion of strong permission. We will proceed incre- 
mentally: this section, as well as Section|4] works only with obligations and strong per- 
missions expressed by rules for P. In Section|6]we will show how weak permissions and 
strong permissions based on defeaters can be easily captured in the framework. 

We consider a logic whose language is defined as follows. 

Definition 1 (Language). Let PROP be a set of propositional atoms, MOD = {0,P} the 
set of modal operators where O is the modality for the obligation and Pfor permission. 

• The set Lit = PROP U {->p \ p e PROP} denotes the set of literals. 

• The complementary of a literal q is denoted by ^q; if q is a positive literal p, then 
~q is ->p, and if q is a negative literal —\p, then ~q is p. 

• The set of modal literals is ModLit = {□/,-.□/ 1 / e Lit, □ £ MOD}. 

We introduce two preference operators, for obligations and for permissions, and 
we will use when we refer to one of them generically. These operators are used to 
build chains of preferences, called 0-expressions. The formation rules for well-formed 
0-expressions are: 

(a) every literal / £ Lit is an 0-expression; 

(b) if A is an 0-expression, B is an 0-expression and c\ , . . . , £ Lit, then A c\ ■ ■ ■ 
q is an 0-expression, BQc\ • • • 0q is an 0-expression, A QB is an 0-expression; 

(c) every 0-expression and 0-expression is an 0-expression; 

(d) nothing else is an 0-expression. 

In addition we stipulate that and obey the following properties: 

1 . a (b c) = (a b) c (associativity); 

2. 0" =1 fl; = (0/~/fli) (0"=A+i a i) where there exists j such that aj = a* and j < k 
(duplication and contraction on the right). 

Given an 0-expression A, the length of A is the number of literals in it. Given an 0- 
expression A b C (where A and C can be empty), the index of b is the length of A b. 
We also say that b appears at index n in A b if the length of A b is n. 

We adopt the standard Defeasible Logic definitions of strict rules, defeasible rules, 
and defeaters (|5|. However for the sake of simplicity, and to better focus on the non- 
monotonic aspects that Defeasible Logic offers, in the remainder we use only defeasible 
rules and defeaters. In addition, we have to take the modal operators into account. 

Definition 2 (Rules). Let Lab be a set of arbitrary labels. Every rule is of the type 

r:A(r) <—t C(r) 

where 
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1. r G Lab is the name of the rule; 

2. A(r) = {a i , . . . , a n }, the antecedent ( or body ) of the rule, is the set of the premises of 
the rule ( alternatively, it can be understood as the conjunction of all the literals in 
it). Each a,- is either a literal, or a modal literal; 

3. ^>G {=>□ denotes the type of the rule. If'—> is =>■□, the rule is a defeasible rule, 
while if is the rule is a defeater. The subscript □ G MOD in defeasible rules 
represents the modality introduced by the rule itself: the mode of a rule tells us what 
kind of conclusion we obtain from the rule. As we argued in Section [2] we do not 
need to label ~> with any modality; 

4. C(r) is the consequent (or head) of the rule, which is an (^-expression. Two con- 
straints apply on the consequent of a rule: (a)if^-t is then C(r) is a single literal; 
(b) ifD — P, then C(r) must be an Q-expression. 

Given a set of rules R, we will use the following abbreviations for specific subsets of 
rules: 

• Rdef denotes the set of all def eaters in the set R; 

• R[q,n] is the set of rules where q appears at index n in the consequent. The set of 
(defeasible) rules where q appears at any index n is denoted by R[q]', 

• R a with □ G MOD denotes the set of all rules in R introducing modality □; 

• R°[q,n] is the set of (defeasible) rules where q appears at index n and the operator 
preceding it is <£> for n > 1 or the mode of the rule is O for n = 1 . The set of (defeasi- 
ble) rules where q appears at any index n satisfying the above constraints is denoted 
by R°[q\; 

• similarly R p [q, n] is the set of rules where q appears at index n, and the operator pre- 
ceding it is for n > 1 or the mode of the rule is P for n = 1 . The set of (defeasible) 
rules where q appears at any index n satisfying the above constraints is denoted by 
R P [q}. 

Definition 3. A Defeasible Theory /* a structure D= (F,R,>), where F, the set of facts, 
is a set of literals and modal literals, R is a set of rules and >, the superiority relation, 
is a binary relation over R. 

A theory corresponds to a normative system, i.e., a set of norms which are modelled by 
rules. The superiority relation is used for conflicting rules, i.e., rules whose conclusions 
are complementary literals, in case both rules fire. Notice that we do not impose any 
restriction on the superiority relation: it is just a binary relation determining the relative 
strength of two rules. 

Definition 4. A proof P in a defeasible theory D is a linear sequence P(l) ■ ■ - P{n) of 
tagged literals in the form of+d a q and —dnq with □ G MOD, where P(l) . ..P(n) satisfy 
the proof conditions given in Definitions\8\]l 1\ 

The tagged literal +d a q means that q is defeasibly provable in D with modality □, while 
— dnq means that q is defeasibly refuted with modality □. The initial part of length i of a 
proof P is denoted by P(\..i). 

The first thing to do is to define when a rule is applicable or discarded. A rule is 
applicable for a literal q if q occurs in the head of the rule, all non-modal literals in 
the antecedent are given as facts and all the modal literals have been defeasibly proved 
(with the appropriate modalities). On the other hand, a rule is discarded if at least one 
of the modal literals in the antecedent has not been proved (or is not a fact in the case 
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of non-modal literals). However, as literal q might not appear as the first element in an 
0-expression in the head of the rule, some additional conditions on the consequent of 
rules must be satisfied. Defining when a rule is applicable or discarded is essential to 
characterise the notion of provability for obligations (±<?o) an d permissions (±<3p). 

Deflnition5. A rule r G R[q,j] such thatC(r) = c\ © • • ■ ®c/_i 0c/ 0- • -0c„ is applicable 
for literal q at index j, with 1 < j < I, in the condition for ±<?o iff 

(1) for allot € A(r): 

(1.1) if at = Ol then +d l G P(l..n); 

(1.2) if a t = -.O/ then -d Q l 6 P(l..«); 

(1.3) j/flj = PI then +d P l G J°(l..rt); 

(1.4) if a; = -PI then -dpi G P(l..n); 

(1 .5) i/a, = / G Lit f/zen / G F, and 

(2) for all c k G C(r), 1 < k< j, +d Q c k G P(l..n) and (c k & F or ~c k G F). 

Conditions (1.1)-(1.5) represent the requirements on the antecedent as informally de- 
scribed above; condition (2) on the head of the rule states that each element q prior to q 
must be derived as an obligation, and a violation of such obligation has occurred. 

Definition 6. A rule r G R[q,j] such thatC(r) =c\ (g>- ■ ■ 0q_i 0c; 0- • -0c„ is applicable 
for literal q at index j, with I < j <n in the condition for ±dp iff 

(1) forallai G A{r): 

(1.1) if a t = Ol then +d l G P(l..n); 

(1.2) if a t = -.O/ then -d l G P(l..n); 

(1.3) if at = PI then +d P l G P(l..n); 

(1.4) i/fl; = ^PZ f/zen -^ P / G P(l..n); 

(1.5) if at = I G Lit then I G F, and 

(2) /or a// C£ G C{r), 1 <k<l, +doc k G f(l..n) and (c^ ^ F or ^c k E F), and 
{3) for all c k G C{r), l<k<j, -d P c k G P(l..n). 

The only difference with respect to ±<9o is the presence of an additional condition, stating 
that all permissions prior to q must be refuted (condition (3)). 

Definition 7. A rule r ER[q,j] such that C(r) = c\ ® ■ ■ ■ ® cj_ i © ci © • • • 0c„ is discarded 
/or literal q at index j, with 1 < j <n in the condition for ±<9o or ±<9p iff 

(1) f/zere ex/ifi a,- G A(r) such that 

(1.1) ;/a; = OZ f/ien -<9 ^ G P(l..n); 

(1.2) ;/«,- = -^01 then +d l G P(l..n); 

(1.3) ifai = PI then -dpi G P(l..n); 

(1.4) i/a,- = -.P/ f/je« +<9p/ G P(l..n); 

(1.5) i/a, = / G Lit f/zen I £F, or 

(2) f/jere ex;'ifi q G C(r), 1 < < /, 5«c/j f/jaf either —dc>c k G P(l..n) or c k G F, or 

(3) there exists c k G C(r), I < k < j, such that +d P c k G F(l..n). 

In this case, condition (2) ensures that an obligation prior to q in the chain is not in force 
or has already been fulfilled (thus, no reparation is required), while condition (3) states 
that there exists at least one explicit derived permission prior to q. 

We now introduce the proof conditions for ±<9q and ±o\>. 
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Definition 8. The proof condition of defeasible provability for obligation is 

+do: IfP(n + 1 ) = +doq then 
(l)Oq£For 

(2.1) O^q g" F and -^Oq g" F and P^q g^ F and 

(2.2) 3r £ R°[q 7 i] such that r is applicable for q, and 

(2.3) \fs £ R[^q,j], either 

(2.3.1) s is discarded, or either 

(2.3.2) s £ ^° and 3t £ R[q,k] such that t is applicable for q and t > s, or 

(2.3.3) s £ R p URdef and 3t £ R°[q,k] such that t is applicable for q andt > s. 

To show that q is defeasibly provable as an obligation, there are two ways: (1) the obliga- 
tion of q is a fact, or (2) q must be derived by the rules of the theory. In the second case, 
three conditions must hold: (2.1) q does not appear as not obligatory as a fact, and is 
neither provable as an obligation nor as a permission using the set of modal facts at hand; 
(2.2) there must be a rule introducing the obligation for q which can apply; (2.3) every 
rule s for ^q is either discarded or defeated by a stronger rule for q. If s is an obligation 
rule, then it can be counterattacked by any type of rule; if s is a defeater or a permission 
rule, then only an obligation rule can counterattack it. 

The strong negation of the above definition gives us the negative proof condition for 
obligation. Notice that the strong negation of a formula is closely related to the function 
that simplifies a formula by moving all negations to an inner most position in the resulting 
formula, and replaces the positive tags with the respective negative tags, and the other 
way around 1161 171 . 

Definition 9. The proof condition of defeasible refutability for obligation is 

—do-' IfP(n + 1) = —doq then 
(1) Oq F and either 

(2.1) O^q £F or -^Oq £ F or P~q £ F or 

(2.2) Vr £ R°[q,i] either r is discarded for q, or 

(2.3) 3s £ R[~q,j] such that 

(2.3.1) s is applicable for and 

(2.3.2) if s £ R° then Vt £ R[q,k], either t is discarded or t s, and 

(2.3.3) ifs £ R p \JRd e f then Vf £ R°[q,k], either t is discarded ort~£s. 

We now introduce and briefly explain the proof conditions for permission. 
Definition 10. The proof condition of defeasible provability for permission is 

+d P : IfP(n + 1) = +dpq then 
(l)Pq£F or 

(2.1) O^q g" F and -^Pq F and 

(2.2) 3r £ R p [q, i] such that r is applicable for q, and 

(2.3) Vs 6 R°[~q,j], either 

(2.3.1) s is discarded for or 

(2.3.2) 3t £ R[q,k] such that t is applicable for q and t > s. 

This proof condition differs from its counterpart for obligation in two aspects: we allow 
scenarios where both +dpq and +<9p^g hold, but +do^q must not hold (clause 2.1); any 
applicable rule s supporting ^q can be counterattacked by any type of rule t supporting 
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q, as s must be an obligation rule, and permission rules can only be attacked by obligation 
rules (clause 2.3). 

As argued above, we define the negative proof condition for permission as the strong 
negation of that for +dp. 

Definition 11. The proof condition of defeasible refutability for permission is 

-d P : IfP(n + 1) = -d P q then 
(l)Pq F and either 

(2.1) O^q EF or -^Pq E F, or 

(2.2) Mr E R F [q, i], either r is discarded, or 

(2.3) 3s E R°[~qJ] such that 

(2.3.1) s is applicable for ~q, and 

(2.3.2) Vf E R[q,k], either t is discarded ort^s. 

The logic resulting from the above proof conditions enjoys properties describing the 
appropriate behaviour of the modal operators. 

Definition 12. A Defeasible Theory D = (F,R,>) is consistent iff > is acyclic and F 
does not contain pairs of complementary (modal) literals, that is if D does not contain 
pairs like Ol and ->Ol, PI and —PI, or I and ~/. The theory D is O-consistent iff > is 
acyclic and for any literal I, F does not contain any of the following pairs: Ol and O^l, 
Ol and P~/. 

As usual, given a Defeasible Theory D, we will use D h ±<9 n / iff there is a proof P 
in D such that P(n) = ±d n l for an index n. 

Proposition 13. Let D be a consistent Defeasible Theory, and □ E MOD. For any literal 
I, it is not possible to have both D h +d n l and D h —(?□/. 

Proof. It straightforwardly follows from the principle of strong negation proposed in 
M6I17I : indeed, the negative proof tags proposed in this work are defined as the strong 
negation of the positive ones. □ 

The meaning of the above proposition is that it is not possible to prove that a literal is at 
the same time obligatory and not obligatory, or permitted and not permitted. 

Proposition 14. Let D be an O-consistent Defeasible Theory. For any literal I, it is not 
possible to have both D h +dol and D h +do~l. 

Proof. We split the proof in two cases: (i) at least one of Ol and 0~l is in F, and (ii) 
none of them is in F. 

For (i) the proposition immediately follows by the assumption of O-consistency. 
Suppose that Ol E F. Then clause (1) of +<9o holds for /. By O-consistency 0~/ ^ F, 
thus clause (1) of +do does not hold for ~/. Since Ol E F, clause (2.1) of +3q is always 
falsified for ~/, and the thesis is proved. 

For (ii): First of all, it is easy to verify that no rule can be at the same time applicable 
and discarded for the derivation of ±c?o/(~/). Then, since both +dol and +dc>~l hold, 
we have that there are applicable obligation rules for both I and ~Z. This means that 
clause (2.3.2) holds for both +dol and +do~l. Therefore, for every applicable rule for I 
there is an applicable rule for ~l stronger than the rule for /, and symmetrically, for every 
applicable rule for ~/ there is an applicable rule for I stronger than the rule for ~/. Since 
the set of rules in a theory is finite, the situation we have just described is possible only 
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if there is a cycle in the transitive closure of the superiority relation. Therefore, we have 
a contradiction because the superiority relation is assumed to be acyclic (the transitive 
closure of the relation does not contain cycles). □ 

The meaning of the proposition is that no formula is both obligatory and forbidden at the 
same time. However, the proposition does not hold for permission. It is possible to have 
both the explicit permission of / and the explicit permission of ~Z. 

The relationships between permissions and obligations are governed by the follow- 
ing proposition: 

Proposition 15. Let D be an O-consistent Defeasible Theory. For any literal I: 

1. ifD h +d l, then D h -d ~l; 

2. ifD h +d l, then D h -dp~l; 

3. ifD h +d P l, then D h -<9 ~/- 

Proof. Q] Let D be an O-consistent Defeasible Theory, and D h +3qI. Literal ^l can 
be in only one of the following mutually exclusive situations: (i) D h +do~l', (ii) D h 
—do~l\ (iii) D \f ±do^l- Proposition[T4lallows us to exclude case (i) since D h +dol by 
hypothesis. Situation (iii) denotes situations where there are loops in the theory involving 
literal but inevitably this would affect also the provability of literal /, i.e., we would 
not be able to give a proof for +9qI as well. This is in contradiction with the hypothesis; 
thus, situation (ii) must be the case. 

|2] Let D be an O-consistent Defeasible Theory, and D h +dol. By definition of proof 
conditions for +do, statements (1)— (2.3.3) hold. 

If Ol G F, then condition (2.1) of — dp holds for ~Z. Furthermore, by O-consistency 
of D, Ol G F implies condition (1) of — dp for ^l, and we obtain the thesis. 

Otherwise, from condition (2.2) of +do, conditions (2.3) and (2.3.1) of — <9p follow. 
Again, we can iterate the same reasoning for condition (2.3. 1) of +<9o implying condition 
(2.2) of — dp. It remains to consider conditions (2.3.2) and (2.3.3) of +<9<> in the first 
case, the attacking rule s is an obligation rule, thus it is of no interest in this proof since 
in condition (2.2) of — dp we consider only permission rules. Thus, for the latter case, 
we know there exists a rule t for obligation that is stronger than s, and this tuple of rules 
(t , s) in condition (2.3.3) for +<9q is the equivalent but opposite tuple of the rules used in 
condition (2.3.2) for — <9p. But, to analyse in an exhaustive way condition (2.3.2) of — <?p, 
we have to take into consideration the whole set of rules S — {s\,...,s n } for permission 
leading to ~/, against the set of rules T = {ti,...,t m } for obligation leading to /0 For 
each subset S' of S, every rule / G S' is either discarded, or there exists a rule t ' G T that 
is stronger (the existence of t' is guaranteed by the fact that +dol holds by hypothesis). 
We can now remove S' from S (as it cannot be used for proving +dp~l), reducing the 
number of elements in S. The iteration of this procedure eventually empties the set S 
since the number of rules in D is finite, and the superiority relation is acyclic. 

[3] Let D be an O-consistent Defeasible Theory, and D h +dpl. By definition of proof 
conditions for +dp, statements (1) or (2.1)-(2.3.2) hold. The proof follows step by step 
that of Part 2 of the proposition. Moreover, steps for conditions (l)-(2.2) are the mere 

4 For examples situations like 0~/ =^o ~', where the proof conditions will generate a loop without intro- 
ducing a proof. 

5 Notice that the rules in conditions (2.2) and (2.3.3) are different rules: they form a team that can defeat 
teams of rules for the opposite. 
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juxtaposition. It remains to analyse the interrelationship between condition (2.3) of +<3p 
and conditions (2.3.2)-(2.3.3) of — do- Since condition (2.3) of +dp takes into account 
only rules for obligation which are systematically defeated with an analogous process of 
rule elimination, thus conditions (2.3.2) and (2.3.3) of — do are satisfied. □ 

The combination of Part|2]and|3]of Proposition[l5]describes the consistency between 
obligation and permission. Part [3] also gives the relationships between strong and weak 
permission. As we discussed in Section [T] a weak permission is a permission obtained 
from the failure to derive the opposite obligation. This means that we have the weak 
permission of p when we have —do~p, and Part[3]guarantees that we have it when +dpp 
holds. 

We conclude this section showing how the logic developed hitherto works with the 
example introduced at the end of Section|2] 

Example. Let us recall the scenario reported at the end of Section [2] and formally ex- 
plain the conclusions of the theory using applicability of rules and proof tags as de- 
fined above. The primary obligation to call the ambulance is obtained (i.e., we derive 
+doCallAmbulance), but the obligation is violated as —C 'all Ambulance 6 F, making 
r\ applicable for Help; rule rj, is applicable for literal -^Help and could attack r\, but 
7*1 > r3, thus we have also +doHelp. Also CallFiremen is derived as an obligation 
but it is violated, thus rule r^ is applicable for literal Extinguish in the condition for 
+do- As +doHelp holds, r^ is applicable for ^Extinguish, and rj, > r%, thus we derive 
+ dp -<Ext inguish. 

4. Algorithms for defeasible extension 

We now present procedures and algorithms apt to compute the extension of a finite De- 
feasible Theory, i.e., a theory where the set of facts and rules is finite, in order to bound 
the complexity of the logic introduced in the previous sections. The algorithms are based 
on the algorithm proposed by Maher 11231 to show that Defeasible Logic has linear com- 
plexity; the algorithms also incorporate the notion of inferiorly defeated rules proposed 
by ll22l to handle directly the superiority relation. 

This section is divided in three main parts. In the first part we give the formal def- 
initions and introduce the notation adopted. The second part, which contains the main 
body, describes the required computations: Algorithms [5] and ineffectively compute the 
defeasible extension of a Defeasible Theory given as an input, while Algorithms [T| [2] 
and [3] are but auxiliary procedures that execute all the necessary operations due to any 
modification of the extension. Each algorithm is followed by a technical explanation on 
how it works. In the third part we present formal properties that are meant to prove the 
computational results proposed in Section[5] 

4.1. Notation for the algorithms 

We introduce the notation relevant to our framework. 

Given a Defeasible Theory D, HBo is the set of literals such that the literal or its 
complement appears in D, where 'appears' means that it is a sub-formula of a modal lit- 
eral occurring in the theory. The modal Herbrand Base of D is HB = {Dl\ □ g MOD, / € 
HBo}- Accordingly, the extension of a Defeasible Theory is defined as follows. 
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Definition 16. Given a Defeasible Theory D, the defeasible extension ofD is defined as 

E(D) = (+d ,+dp,-d ,-dp), 

where ±<9 n = {/ G HBo ■ D h ±dnl} with □ G MOD. We define two Defeasible Theories 
D and D' to be equivalent (in notation D = D') if they have the same extensions, i.e., 
E{D)=E{D'). 

The next definition introduces two syntactical operations on the consequent of rules used 
by the algorithms, whose meaning will be clear in the remainder. 

Definition 17. Let c\ = a\ • • • a/_ i and C2 = • • • a n be two (possibly empty) 
^-expressions such that a,- does not occur in them, and c = c\ a; C2 is an 0- 
expression. Let r be a rule with form A(r) ^ c. We define the operation of truncation o/ 
the consequent c at a, as: 

A(r) =-> c!a; = A(r) <->• ci 0a;. 
We define the removal of at from the consequent c, A(r) >• c0a,-, as: 

fA(r) ci 0C2 f/r isA(r) ci 0a,0C2 

A(r) ci 0C2 ifr isA(r) =>o c\ 0a,-0C2 

A(r) ^dgmod ci 0C2 ifr is A(r) =»d G mod Q 0a,-0c 2 

k A(r)=^ P C2 i/r /s A(r) =>o a/0C2 

The next definition extends the concept of complement presented in Section[3]for modal 
literals, and it is used to establish the logical connection among proved and refuted liter- 
als in our framework. 

Definition 18. We define the complement of a given literal I, denoted by I, as: 

1. If I G Lit, then 1 = {~l}; 

2. If I =Om, then I = {->Om,0^m,P^m}; 

3. If I = -iOm, then 1 = {Om}; 

4. If I =Pm, then 1 = {-iPm,0~m}; 

5. If I = -iPm, then 1 = {Pm}. 

Given □ G MOD, the sets ±<9 n denote the global sets of defeasible conclusions (i.e., the 
set of literals for which condition ±d a holds), while 9q are the corresponding temporary 
sets. Notice that the complement of -Pm does not include Om (and vice versa) because 
the failure to derive Pm cannot depend on the derivation of Om, but rather on the fact that 
O^m is the case. 



A{r) 



4.2. Algorithms 



We begin this subsection by reporting and explaining the three auxiliary procedures used 
in the two main algorithms for the computation of the extension of a logic. 

Algorithm[T] DISCARD performs all operations related to when —d n l holds for a given 
literal /. 

First of all, literal / is placed in the local set of refuted literals with modality □ (line 
2). Furthermore, condition — dnl makes literal ->□/ provable, therefore it can be safely 
removed from all rules where it appears as an antecedent, being that its contribution 
to a rule being applicable or refuted has already been established. Since I cannot be 
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Algorithm 1 Discard 

l: procedure Discard(/ g Lit, □ e {P,0}) 

2: dn<-dnU{/} 

3: R ^ {A(r)\{^Ul} ^ C{r)\ r £ R}\{r £ R\ □/ G A(r)} 
4: ><-> \{(r,s), (s,r) £> | □/ G A(r)} 
5: HB^HB\{Ol} 
6: end procedure 



proved with modality □, every rule containing □/ in its body is discarded by clauses 
(1.1) and (1.3) of Definition [7] and thus we can remove such rules without affecting 
the conclusions that can be derived from the theory (line 3). In addition, we remove all 
pairs involving the rules from the superiority relation (line 4), and □/ from the modal 
Herbrand Base (line 5). 

Algorithms [2] ModifyObl and [3] ModifyPerm behave in a very similar way: both 
of them modify the theory to accommodate the positive derivation of a modal literal. 
They only differ on the kind of rules they manipulate (obligation and permission rules, 
respectively). 



Algorithm 2 ModifyObl 
l: procedure ModifyObl(/ g Lit) 

2: d$^d+U{l} 
3: d ^d Q l){~l} 
4: d p <- <9 p U{-Z} 

5: HB<^HB\{Ol,0~l,P~l} 

6: ifOZ^Fthen 

7: R<- {A(r) \ {Ol, -.CW} =— > C(r)\r £R}\{reR\ A(r) nOZ + 0} 

8: >^>\{(r,*),(i,r)e>|A(r)nO/^0} 

9: end if 

10: R <r- {A(r) C(r) 9/| r Gi?°[Z,n] for an index «} 
11: {A(r) C(r) 9~/| r G R p [~l,n] for an index «} 

12: /?^{A(r) M-C(r)!~/9~/| rGi?°[~/,n] for an index n} 
13: end procedure 



The input of both procedures is a literal I. As such, we add it to the corresponding set 
of derived literals (line 2). Since D h +dol implies D h — c?o~/, —dp^l by Proposition[T5l 
Part[T]and|2j and D h +<9p/ implies D h —do~l by Proposition[T5lPart[3l we also remove 
~Z from the appropriate sets of refuted literals; then the modal literal along with the set 
of its complementaries^ are removed from the Modal Herbrand Base (lines 3-5 and 3-4, 
respectively). Lines 6-9 and 5-8, respectively, follow the same reasoning of line 3 in 
Algorithm [TJ Discard. Finally, the rules of the theory are modified on account of the 
modality the literal is derived with as well as the conditions for the applicability of a rule 
given in Definitions |5]-|7](lines 10-12 and 9-10, respectively). 



'Notice that we do not remove any negative modal literal from HB by definition of modal Herbrand Base. 
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Algorithm 3 ModifyPerm 



l: procedure ModifyPerm(7 £ Lit) 

2: d+^d+U{l} 
3: <5 ^«? U{~/} 

4: HB<^HB\{Pl,0~l} 

5: ifP/^Fthen 

6: <- {A{r) \ {PI, -.0~/} ^ C(r)J_r £ /?} \ {r £ R\ A(r) DPI ^ 0} 

7: >^>\{M,(*,r)e>|A(r)nP/^0} 

8: end if 

9: tf^{A(r) M-C(r)!~/9~/| reR°[~l,n] for an index «} 

10: R «- {A(r) C(r)!/| r £ R p [l,n] for an index n} 
li: end procedure 



Algorithm 4 CheckFacts 



procedure CheckFacts 
for I e F do 

/? <- {A(r) \ {/} ^ C(r)| r £ /?} \ {r £ fl| A(r) nf ^ 0} 

>^>\{( M ),(v)e>|A(r)n;^} 

if Z £ Lit then 

R <- {A(r) ^ C(r)!/| r £ R°[l,n] for an index w} 
end if 

if I = Om then 

ModifyObl(ot) 
end if 

if / = -iOm then 

— do < do U {fit} 

HB «— HB \ {Om} 

R <— {A(r) C(r)!mQm| r £ /?°[m,n] for an index «} 
end if 

if / = Pm then 

MODIFYPERM(m) 

end if 

if / = -Pm then 

— dp < dp U {m} 

HB<-HB\{Pm,Om} 

R <— {A(r)\ M> C(r) 0m| r £ R F [m,n] for an index n} 
end if 
end for 
end procedure 



Before describing how Algorithm |4] works, let us recall some concepts about the 
provability of a literal. Given a Defeasible Theory, a modal literal □/ £ F is trivially 
proved with the corresponding modality by definition. Furthermore, we also stated that a 
non-modal literal is proved within the theory if it is a fact. 

Based on these facts, the procedure described in Algorithm|4]CHECKFACTS begins 
by removing all factual literals from every rule where they appear as an antecedent; it also 
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removes all rules whose body contains a complementary literal (line 3). The superiority 
relation is then modified in view of this operation (line 4). 

From this point on, different operations are performed on account of which kind of 
factual literal is considered. 

1. If / is a non-modal literal, we truncate the head of all rules at /, where / appears as 
an obligation (lines 5-7); 

2. if / is a positive modal literal for obligation (lines 8-10) or permission (lines 16-18), 
then Algorithm|2]MODlFYOBL (respectively Algorithm[3]MODlFYPERM) is called 
to properly modify the theory. Notice that operations in lines 7-8 of Algorithm |2] 
ModifyObl and 6-7 of Algorithm[3]MODlFYPERM are not performed in this case, 
since they are equivalent to lines 3-4 of Algorithm|4]CHECKFACTS; 

3. if I is a negative modal literal for obligation -iOra (lines 11-15), then —dom holds, 
and clause (2) of Definition [7] makes all rules containing m as an obligation in their 
heads discarded for all literals after m. Hence, we truncate all these chains at m, and 
then remove m (line 14); 

4. if / is a negative modal literal for permission —Pm (lines 19-23), then —dpin holds 
in the theory. Thus, we remove m in every chain where m appears as a permission 
(line 22). 

We conclude this section by presenting and describing Algorithm|3]COMPUTEDEFEASlBLE, 
which represents the main core for the computation of the defeasible extension of a 
theory. 

In lines 1-5, we initialise variables +do, +<9p and, for each literal I, a set S[l]j„« con- 
taining all the rules for I that are defeated by a rule for the opposite. Algorithm [4] 
CheckFacts is invoked to compute all defeasible conclusions derived from the set of 
facts (line 6). 

The algorithm consists of a main loop (the repeat cycle in lines 7-35) that performs 
a series of transformations to reduce a Defeasible Theory into a simpler equivalent one. 
The loop ends when no more modifications on the extension are made, i.e., when both 
variables and <?□ are empty at the end of an iteration. 

At the beginning of the cycle, we re-initialise the set of conclusions computed at the 
iteration of the main loop (lines 8-9). 

The for cycle in lines 10-32 checks all the rules for every literal I of the theory. In 
lines 11-13 it modifies the theory invoking Algorithm[T]DlSCARD for all modal literals 
with no supporting chains. Lines 14-31 loop over all rules in the theory for the current 
literal /, and checks if an applicable rule exists with I as first element in its head. If the 
rule introduces / as an obligation (lines 14-22), then we have to collect all rules for the 
opposite, and check if they are all defeated by a rule for /. If this is the case, then we have 
proved +<?o' and Algorithm[2]MODlFYOBL must be invoked. 

On the other hand, if I is introduced as a permission (lines 23-31), then we have to 
take into account only obligation rules for ~Z, and to check if every rule for as an 
obligation is defeated by at least one rule for the opposite. If so, condition +dpl holds, 
and Algorithm[3] ModifyPerm is invoked. Finally, all modifications on the extension, 
due to the execution of the cycle, are stored in the global sets of conclusions (lines 33- 
34). 
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Algorithm 5 ComputeDefeasible 



Input: A defeasible theory D. 
Output: The extension E(D) of D. 
l: for □ e {0,P} do 

2: +<?□ <r- 
3: -d n <- 

4: end for 

5: R[l]mfd for each / G Lit 

6: CHECKFACTS 

7: repeat 

8: <? + <- 



9: <?□ <- 

10: for □/ &HB,D e {0,P}do 
li: if R a [l] = 0then 

12: DlSCARD(/,D) 

13: end if 

14: if there exists r e R°[l, 1] such that A(r) = then 

15: R[~l]infd <~ RHUfd U {i G /?[~Z] | r > s} 

16: if {s G s > r} = then 

17: DlSCARD(~/,D) 

18: if i?[~Z] \i?[~/] /n / d = and -O/ g F then 

19: MODIFYOBL(Z) 

20: end if 

21: end if 

22: end if 

23: if there exists r G R F [l, 1] such that A (r) = then 

24: KHWd <- * H]m/d U {i G R°[~l] | r > s} 

25: if {s G s > r} = then 

26: DlSCARD(~Z,0) 

27: if R°[~l] \R[~l] infd = then 

28: MODIFYPERM(Z) 

29: end if 

30: end if 

31: end if 

32: end for 

33: +<?□ «- +<?□ U <9^ 

34: -d n < <?□ U (?□ 

35: until d£ = and <?□ = 

36: return = (+<9o,+<5p,-<5o 1 -<5p) 



4.5. Properties of defeasible theory transformations 

The properties we are going to show below are related to operations that transform a 
theory D into an equivalent simpler theory D' (where by the term 'simpler' we mean a 
theory with a minor number of symbols in it). 

The transformations operate either by removing some elements from it, or by delet- 
ing a rule from the theory. Given the functional nature of the operations, we will refer to 
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the rules in the target theory with the same names/labels as the rules in the source theory. 
Thus, given a rule r € D, we will refer to the rule corresponding to it in D' (if it exists) 
with the same label, namely r. 

For the sake of readability, the proofs of all the theoretical results (Lemmas [T9H281 ) 
are not reported in this subsection and the interested reader can find them in AppendixlAl 

Given a non-modal literal p E F, we can obtain an equivalent theory by removing p in 
every rule where it appears in the antecedent. Moreover, if the rule is for an obligation, 
Definition [7] clause (2) ensures that the rule will be discarded for every element after 
p, and therefore we can truncate the reparation chain at p. Instead, if the rule is for a 
permission, we cannot operate on it. In both cases, we only consider rules where the 
complement of p does not appear in the antecedent. Finally, the superiority relation can 
be simplified by removing all tuples with a rule containing ~p in the antecedent, or an 
obligation rule for an element after p in its consequent. 

Lemma 19. Let D = (F,R,>) be a theory such that p e F n Lit. Let D' = (F',R', >') be 
the theory obtained from D where 



Then D = D'. 

Starting from the modified theory given by the transformations of the previous lemma, 
we now consider a theory with only modal literals in the set of facts. If a literal p is 
provable as an obligation, then we can simplify the theory by removing Op in every an- 
tecedent of the rules in R, and erase the rules where at least one element of Op appears 
in the antecedent. Since by hypothesis F D Lit = 0, if p is present in the reparation chain 
of an obligation rule, we simplify the theory by removing p from the consequent. If ~p 
is in the consequent, we can also truncate the reparation chain of the rule since, by Defi- 
nition|7]clause (2), the rule will be discarded for each element after ^p (Proposition[T5l 
Part Q] states that —do~p holds as well). Moreover, Proposition IT31 Part [2l ensures that 
—dp~p holds. Thus, Definition|6]clause (3) allows us to remove <~/> in the consequent of 
permission rules for ~p. Finally, the superiority relation can be simplified by removing 
all tuples with a rule containing at least one element of Op in the antecedent. 

Lemma 20. Let D = (F,R, >) be a theory such that F n Lit = and D h +dop. Let 
D' = (F,R' , >') be the theory obtained from D where 



R' ={r:A(r)\{Op}^ C(r)l~pQ~p\ r G R, A(r)nO/? = 0}U 
{r :A(r) \ {Op} C(r) Qp\ r € R, A{r)f]Op = 0} U 
{r:A(r)\{Op}^>pC(r)e~p\ reR, A(r) C\Op = @} 

>'=>\{(r,s),(s,r)\ r, S eR,A(r)nOp^<d}. 
Then D = D' . 



F' 



F\{p] 

{r : A(r) \ {p} C{r)\p\ r e R, A{r) Dp = 0} U 
{r:A(r)\{p}^ P C(r) \ r£R, A(r)n/5 = 0} 
>\{(r,s),(s,r)\ r,s ER,A(r)np^9>}. 



R 1 



>' 
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As the previous lemma, we consider a theory with only modal literals in the set of facts. 
Since the theory proves —dop, also -Op holds. Thus, we obtain an equivalent simpler 
theory by erasing all rules with Op as one of the antecedents, and by removing -Op 
in each rule where it appears in the antecedent. Again, by Definition [7] clause (2), for 
every obligation rule we can truncate each reparation chain with p in the consequent 
and eliminate it from such a chain. Finally, the superiority relation can be simplified by 
removing all the pairs with a rule containing Op in the antecedent. 

Lemma 21. Let D = (F,R, >) be a theory such that F n Lit = and D h —dop. Let 
D' = (F,R', >') be theory obtained from D where 

R' ={r :A(r)\ {^Op} C(r) r e R, A(r) n {Op} = 0} U 

{r : A(r) =^o C(r)\p Q p\ r G R, A(r) D {Op} = 0} 

>'= > \{M, (s,r)\ r,s G R,A(r) D {O/;} / 0}. 

77ien D = D'. 

We can defeasibly prove a literal p as a permission. A simpler equivalent theory is one 
where we remove Pp in each set of antecedents and where we erase all the rules con- 
taining at least one element of the complement of Pp in the antecedent. Proposition [15] 
Part |3] states that —do^p holds. Thus, by Definition [7] clause (2), if ~p appears in the 
reparation chain of an obligation rule, we can remove it after having truncate the chain 
at ~p. Instead, if we consider permission rules with p in the consequent, by Definition|7] 
clause (3), we can truncate the corresponding reparation chain at p. Finally, the superi- 
ority relation can be simplified by removing all the pairs with a rule with an element of 
Pp in the antecedent. 

Lemma 22. Let D = (F,R, >) be a theory such that F n Lit = and D h +dpp. Let 
D 1 = (F,R ! , >') be theory obtained from D where 

R' ={r:A(r)\{Pp}^ C{r)\~pQ~p\ r 6 R, A{r)C\Pp = %} U 

{r : A(r) \ {Pp} ^ P C{r)\p\ reR, A(r) nPp = 0} 

>'= > \{(r, s), (s, r) | r, s G R, A(r) n Pp ± 0}. 
7%en D = D'. 

The theory proves —dpp, allowing -Pp to hold. Thus, we obtain an equivalent theory 
if we erase all the rules with Pp in the set of the antecedents and if we remove -Pp 
where it appears in the tail of a rule. Moreover, if the rule is for a permission, we remove 
p from the reparation chain. Finally, we change the superiority relation by erasing the 
tuples with a rule with Pp in the antecedent. 

Lemma 23. Let D = (F,R,>) be a theory such that F n Lit = and D h —dpp. Let 
D' = (F,R', >') be theory obtained from D where 

R' ={r : A(r) \ {^Pp} =* n C(r)\ r £ R, A(r) D {Pp} = 0} U 

{r : A(r) ^ P C(r) G p\ r £ R, A{r) n {Pp} = 0} 

>'= > \{M, (j,r)| r,s G R,A(r) n {P/^} ^ 0}. 

T/zen D = D'. 
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The following two lemmas represent conditions under which a literal can be proved as 
an obligation or as a permission. The transformations dictated by the previous lemmas 
empty the antecedent of every applicable rule. 

Definition 24. Given a theory D = (F,R,>), and a set of rules S, the subset of S of 
inferiorly defeated rules for a literal p, S[p]t n fd is thus defined: r G S\p\infd iff 

1. 3s G R[~p] such that A(r) = and s > r, and 

2. ifr<= R p [p\, then s G fl°H. 

Lemma 25. Let D = (F,R, >) be a theory such that F n ModLit = 0, 3r e R°[p, 1], 
A(r) = 0, andR[~p] C R infd . Then D h +d p. 

Lemma 26. Let D = (F,R, >) be a theory such that F n ModLit = 0, 3r G R p [p, 1], 
A(r) = 0, andR°[~p] C fl in/d . 7%en D h +^79. 

The next two lemmas concern conditions to determine when it is possible to assert that a 
literal is negatively provable. 

Lemma 27. Let D = (F,R,>) be a theory such that F (1 ModLit = and R n \p] = 0, for 
□ G {0,P}. Then D h -d n p. 

Lemma 28. Let D = (F,R, >) be a theory such that F n ModLit = 0, and 3r G R[p, 1] 
such that A (r) = a«af r s „p = 0. T/ien 

1. ifr G f/je« D h -5 n ~/J, □ G {0,P}; 

2. i/re R p UR def , then D\--d ~p. 



5. Computational results 

In this section we present the computational properties of the algorithms previously de- 
scribed. Since, as stated above, the first three algorithms are sub-routines of the two main 
ones, we will present the correctness and completeness results of these algorithms inside 
theorems for Algorithms|4]CHECKFACTS and|5]COMPUTEDEFEASlBLE. 

In order to properly exhibit results on the complexity of the algorithms, we need the 
following definition. 

Definition 29. Given a Defeasible Theory D, the size S of D is the number of literal 
occurrences plus the number of the rules in D. 

We also report some key ideas and intuitions behind our implementation. 

1 . Each operation on global sets ±<9 D and requires a constant time, as we manipulate 
finite sets of literals; 

2. For each literal □/ G HB, we implement a hash table with pointers to rules where 
the literal occurs; thus, retrieving the set of rules containing a given literal requires 
constant time. 

3. The superiority relation can also be implemented by means of hash tables; once 
again, the information required to modify a given tuple can be accessed in constant 
time. 

Theorem 30. Given a modal Defeasible Theory D with size S, A/gon'f/z;«|?]CHECKFACTS 
terminates and its computational complexity is 0(S). 
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Proof. Termination of Algorithmic] CheckFacts is given by definition of modal De- 
feasible Theory, since the internal sub-routines (i.e., Algorithm [2] ModifyObl and [3] 
ModifyPerm), as well as the algorithm itself, manipulate finite sets of rules and facts. 

For a correct analysis of the complexity of Algorithm|4]CHECKFACTS, it is of the 
utmost importance to correctly comprehend Definition [29] Here we underline that the 
size 5 of a theory represents the total number of occurrences of each literal in every rule 
of such a theory. Let us examine a theory with Y literals and whose size is Z. If we 
consider a cycle whose purpose is to call, for each literal, a procedure that selectively 
deletes it from all the rules of the theory (no matter to what end), a rough computational 
complexity would be 0(Z 2 ). In fact, the complexity of the procedure by itself is bound 
to the number of rules in the theory, which is in 0(Z), and this procedure is iterated 
Y e 0(Z) times. 

However, a more fined-grained analysis shows that the complexity of this loop is 
lower. The mistake of the previous analysis is that it considers the complexity of the pro- 
cedure separately from the complexity of the external loop, whilst they are strictly de- 
pendent. Indeed, the overall number of operations made by the sum of all loop iterations 
cannot outrun the number of occurrences of the literals, 0(Z), because the operations 
in the inner procedure directly decrease, iteration after iteration, the number of the re- 
maining repetitions of the outmost loop, and the other way around. Therefore, the overall 
complexity is not bound to O(Z) • O(Z) = 0(Z 2 ), but to 0(Z) + 0(Z) = 0(Z). 

We can contextualise the above reasoning to Algorithm[4]CHECKFACTS. The main 
cycle in lines 2-26 is iterated over the set of facts, whose cardinality is in 0(5); the op- 
erations in lines 10 and 19 (invoking Algorithms[2]MODlFYOBL and[3]MODlFYPERM) 
represent an additive factor 0(5) in the overall complexity of the algorithm. Finally, all 
operations on the set of rules and the superiority relation performed by conditions in lines 
5, 12, and 21 require constant time, given the implementation of data structures proposed 
above. Therefore, we can state that the complexity of the algorithm is 0(5). □ 

Theorem 31. Given a Defeasible Theory D with size S, Algorithm\5\ 
COMPUTEDEFEASIBLE terminates and its computational complexity is 0(5). 

Proof. When referring to the termination of Algorithm [5] COMPUTEDEFEASIBLE, the 
most important part we have to analyse is the repeat cycle in lines 7-35. Once an instance 
of the cycle has been performed, we must be in one of the following (mutually exclusive) 
situations: 

1. no modification of the extension has occurred. In this case, line 29 ensures the ter- 
mination of the algorithm; 

2. the theory is modified with respect to a literal in the Modal Herbrand Base HB. 
Notice that the algorithm takes care of removing the literal from HB once it has 
performed the suitable operations. As the set is finite, the process described above 
eventually empties HB, and at the next iteration of the cycle we have no means 
to modify the extension of the theory. In this case as well, the algorithm ends its 
execution. 

The analysis of the complexity of Algorithm [5] COMPUTEDEFEASIBLE straightly fol- 
lows from the reasoning proposed to demonstrate the computational complexity of Algo- 
rithm|4]CHECKFACTS. Thus, the repeat cycle in lines 7-35 is in 0(5), while procedure 
invocations in lines 12, 17, 19, 26 and 28 represent an additive factor as before. Since the 
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operations in lines 15and24, and the checks in lines 14, 16, 18, 23, 25 and 27 also weight 
a constant time, the computational complexity of Algorithm [5] ComputeDefeasible 
is bound to 0(5). □ 



Theorem 32. A/gon'f/!ra[5]COMPUTEDEFEASlBLE is sound and complete. 

Proof. As already argued at the beginning of the section, the aim of Algorithm 
ComputeDefeasible is to compute the defeasible extension of a given theory D 
through successive transformations on the set of facts and rules, and on the superiority 
relation. These transformations act in ways which obtain at each step a new simpler the- 
ory while retaining the same extension. Again, we remark that the word 'simpler' is used 
to denote a theory with less elements in it. Since we have already proved the termination 
of the algorithm, it eventually comes to a fix-point theory where no more operations can 
be made. 

In order to demonstrate the soundness of Algorithm [5] we show in the list below 
that all the operations performed by the algorithm are those described in Lemmas [T9Tl2"8"l 
where we have already proved the soundness of the operation involved. 

• Algorithm[T]DlSCARD: 

- Lines 2-4: Lemmal2Tlandl23l 

• Algorithm|2]MODlFYOBL: 

- Lines 2-4, 10-13: Lemmal20l 

- Lines 6-9: Proposition[l4]and Lemmal20l 

• Algorithm[3]]V10DlFYPERM: 

- Lines 2-3, 9-11: Lemma l22l 

- Lines 5-8: Proposition[l3]and Lemma l22l 

• Algorithm|4]CHECKFACTS: 

- Lines 3-4: Lemmas [T9H231 

- Lines 5-8: Lemma [T9l 

- Lines 9-11: Algorithm^ 

- Lines 12-17: Lemma[2"Tl 

- Lines 18-20: Algorithm[3j 

- Lines 21-25: Lemmal23l 

• Algorithm [5] ComputeDefeasible: 

- Lines 11-13: Lemma[27l 

- Lines 17 and 26: Lemma|28l 

- Lines 18-20: Lemmas |251 and l20l 

- Lines 27-29: Lemma[26land[22l 

These results state that if in the initial theory a literal is either defeasibly proved or not, 
so it will be in the final theory; thus proving the soundness of the algorithm. 

Moreover, since all lemmas show the equivalence of the two theories, and since 
the equivalence relation is a bijection, this also gives the completeness of Algorithm [5] 
ComputeDefeasible. □ 
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6. Discussion: The Three Types of Permission 

Resuming the discussion of Section [2] we will delve into the technical aspects of the 
three mentioned concepts of permissions within our framework. 

The idea of weak or negative permission is easily represented in the system as fol- 
lows: 

Definition 33 (Weak Permission). Let D be a Defeasible Theory. A literal I is weakly 
permitted in D iffD h —do^l. 

One remark is in order here: Definition [33] is useful to check whether a literal I is 
weakly permitted within the theory, but it cannot be directly used to explicitly derive PI 
for triggering any rule where this modal literal occurs in the antecedent. In fact, when 
PI appears in the antecedent of a rule, then the only way to activate such a rule is to 
explicitly derive PI. 

However, weak permissions are decisive in the applicability of a rule for conditions 
(1.2) of Definitions [5] and |6j when ^O/ occurs in the antecedent of the rule, then the 
theory must prove — dol. This is equivalent to say that ~/ is weakly permitted in D. 

This reading assumes that the distinction between weak and strong permission goes 
beyond the idea, defended by (2), that there is only one prescriptive type of permission. 
If the reader finds our proposal limiting, we can trivially revise the rule applicability 
conditions at point (1.3) (and adjust the algorithms accordingly) by establishing that, 
when PI occurs in the antecedent of any rule r, r is applicable if one of the following 
conditions holds: (i) +dpl, or (ii) —do^l (observe that +o\>l implies —do~l, but not vice 
versa). 

A straightforward result (from Proposition Q3] Part Q3 regarding weak permissions 
follows: 

Proposition 34. Let D be any O-consistent Defeasible Theory. For any literal I, if 
D h +dol, then I is weakly permitted. 

As expected, weak permission enjoys the deontic principle "Ought implies Can", 
i.e., the principle that in deontic logic is Ol — > PI. 

We now consider the two ways to obtain strong permissions in Defeasible Logic: using 
either explicit permissive norms or defeaters. 

The first case is naturally captured in the logical framework proposed in Sections 
[3] and [4] In the simplest case, a literal like PI is derived in a theory D when there is a 
successful reasoning chain in which the last rule has the form a\,...,a n =>p /. 

More complex cases are due to the fact that / may occur in an 0-expression. In this 
case I is obtained as strongly permitted if, for each literal c preceding / in the sequence, 
one of the following conditions hold: 

• if c leads to derive Oc (i.e., c occurs in an ©-subsequence of the main sequence 
where / occurs), then this obligation must be obtained and violated; 

• if c leads to derive Pc (i.e., c occurs in an ©-subsequence of the main sequence where 
/ occurs), then this permission is successfully attacked by an opposite obligation. 

The introduction of sequences of permissions and obligations enriches the language in 
a significant way, since it allows us to express a preference among obligations and per- 
missions when they are logically compatible. In the case of sequences of positive per- 
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missions, an ©-sequence states that a permissive exception of an obligation is preferred 
with respect to another possible exception of the same obligation. However, this exten- 
sion does not conceptually change the fundamental intuition that is also behind the basic 
case where permissive norms have the form a\,...,a„ =>p I: the antecedent of positive 
permissive rules with head / provides sufficient defeasible reasons to derive PI. 

The second method considered in Section[2]to capture the notion of strong permis- 
sions acting as exceptions to obligations looks at permissions as undercutters in argu- 
mentation theory (this idea was discussed in |[T0ll ): a permissive norm with head / op- 
erates in such a way that, if applicable, it is not a sufficient reason for deriving neither 
Z, nor ~/, but it is a sufficient reason for blocking the derivation of ~Z as obligatory. 
In Defeasible Logic, this idea is naturally implemented by using defeaters. For the sake 
of simplicity, we have not considered this concept of strong permission in Sections [3] 
and [4] However, to cover this case it is sufficient to adopt one the following definitions 
(compare the definition of R p [q,n] in SectionfJ]): 

Definition 35. The set R p [q, n] isXUY where 

• X is the set of rules where q appears at index n, and the operator Q precedes q; 

• Y is the set of defeaters with head q^\ 

Definition 36. The set R p [q, n] is the set of defeaters with head 

Definition[35]adds the defeaters to the set of rules that can be used to derive tagged 
literals like +<9p/, obtaining modal literals like PI. Definition [36] restricts derivations of 
strong permissions only to reasoning chains where the last rule is a defeater. In both 
cases, except these new definitions, we do not need to change anything else in the logic 
(hence, in the proof conditions for ±<9p) or the algorithms. 

What is the difference between strong permissions obtained via rules for permission 
and the ones obtained via defeaters? Although rules for P and defeaters are not in general 
equivalent, as we have informally suggested in Section [2] they behave quite similarly 
when they are used to derive permissions, as well as to attack obligation rules supporting 
the opposite conclusion. In other words, defeaters do not clash with any permissive rules. 
Consequently, if this reading of defeaters is simply embedded within the proof conditions 
for ±<3p and for ±<9o by adopting either Definition[35j or Definition [36] then rules for P 
and defeaters play a very similar role in the proof theory. In fact, if we consider condition 
(2.3.3) in the proof condition for ±<9o, then two rules like r\ : a\,... ,a n =>p I and r2 : 
a\ , . . . ,a„ ~> I both attack any rule s for obligation supporting ^l, and s can counterattack 
r\ and r^ as well. 

We remark that the significant difference between the rules for P and defeaters is 
that defeaters do not allow for having sequences of permissions in their head. 

Finally, notice that neither type of strong permission considered enjoys the principle 
"Ought implies Can". This result comes directly from Proposition[l5]and is based on the 
idea that the only manner to derive strong permissions is by means of reasoning chains 
where the last rule occurring in them is either a rule for P or a defeater (i.e., explicit 
permissive norms). 



7 In this case, n is always 1. 

8 Since n is always 1, n can be omitted and we can simply write i? p [g]. 
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7. Summary and Related Work 

In this paper we proposed an extension of Defeasible Logic to represent three concepts of 
defeasible permission. In particular, we examined different types of explicit permissive 
norms that work as exceptions to opposite obligations. We also discussed how strong per- 
missions can be represented with or without introducing a new consequence relation for 
inferring conclusions from explicit permissive norms. Finally, we combined a preference 
operator applicable to contrary-to-duty obligations with a new one representing ordered 
sequences of strong permissions which derogate from prohibitions. Special attention was 
devoted to the computational aspects of the logic. 

Although logicians have mostly overlooked the concept of permission over time, 
the history of deontic logic offers some well-known key ideas to interpret it. Indeed, the 
original intuition (proposed by |34] , among others) that permissions are the modal dual of 
obligations, though technically simple and attractive, proved to be partial and simplistic 
(for a discussion, see IB5I2I1ID . Hence, subsequent contributions have helped to expand 
the picture in several directions. The distinction between weak (or negative) and strong 
(or positive) permission (35] plays an important role in this regard. Though, Alchourron 
and Bulygin M3I2II argued that there is only one prescriptive sense of permission, while 
the distinction between weak and strong permission makes sense only at a descriptive 
level, depending on how any permission is obtained within a system of norms. Legal 
theorists such as Alf Ross and Norberto Bobbio 128181 claimed that legal permissions 
are in fact exceptions to obligations imposing the opposite, even though this did not lead 
them (Ross, in particular) to clearly link the concept of exception with the one of strong 
permission. Other theorists even denied the usefulness of seeing strong permissions as 
exceptions 1271291 . since the former ones introduce nothing but strong indifference in 
normative systems. This thesis was instead rejected by 0. 

The purpose of this paper was not to provide a comprehensive logical theory of 
permission, nor to take an exhaustive critical position in the debate that we have very 
briskly recalled. Our goal was twofold: 

• to capture some aspects of permissions within a broader view of defeasible normative 
reasoning; 

• to study the defeasibility of permissions in a computationally efficient logical frame- 
work. 

At a more theoretical level, our work shares with (25 9 33 1 some conceptual assumptions. 
Slightly rephrasing J33j's analysis, the following guidelines inspired our treatment of the 
concept of permission: 

1. "no logic of norms without attention to the system of which they form part" ll26l : 
our investigation of the concept of permission looks at how permissive norms and 
other types of norms interact within systems; 

2. the distinction between positive and negative permission is meaningful; 

3. one fundamental role of positive permissions is that of stating exceptions to obliga- 
tions; accordingly, positive permissions are supposed to override, or at least block, 
some deontic conclusions coming from other norms; 

4. the logical space of weak permission is the one left unregulated by mandatory norms. 

However, 125 : 91331 are all based on a different logical formalism, Input/Output Logic 
(IOL) 1241 . thus it is difficult to compare in detail those contributions with the present 
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one. Normative reasoning is viewed in IOL as a rule-based process of manipulation of 
inputs (factual premises) into outputs (normative conclusions). The analysis of norma- 
tive systems consists in representing conditional norms simply as ordered pairs (a,b) 
where a represents the antecedent of the rule, and b its consequent: "if a then b" where 
a has factual content and b normative content, viz. an obligation or a permission. Typi- 
cally, both a and b are taken to be formulas from propositional logic. Each set of such 
ordered pairs can be seen as an inferential mechanism which, given an input, determines 
an output based on those connections. Formally, given a set of positive mandatory norms 
(obligations) G and a set of permissive norms (positive permissions) P, a closure oper- 
ation C, and a set of facts A, the output of G U P given C and a set of input formulas 
is outc(GUP,A) = {b | (a,b) <E C(GUP) and s 6 A}. This approach allows for defining 
different concepts of permission (25 9^: 

Negative permission: (a,x) is a negative permission w.r.t. G iff (a, -1 *) outc(G); if 
x is not prohibited by the system given a, then is negatively permitted under those 
factual conditions a. 

Static permission: (a,x) is a static permission w.r.t. (G,P) iff (a,x) e outc(GU 
{(c,d)}) for some (c,d) £ P; (a,x) is statically permitted iff it follows from adding 
a positive permissive norm to G; 

Dynamic permission: (a,x) is a dynamic permission w.r.t. (G,P) iff (c,-d) £ 
outc(G, U{a, ~^x}) for some (c,d) £ P; (a,x) is permitted when, given the obliga- 
tions in G, we cannot prohibit x under the condition a without prohibiting d under 
condition c which is however explicitly permitted by the system. 

Another concept of permission was proposed in (331 to specifically capture the idea of 
exceptior0: 

Exemption: (a,x) is an exemption w.r.t. (G,P) iff (a, -<x) g outc(G)\outc(G) — (c, -id) 
for some (c,d) € P\ (a,x) is an exception if the code contains the prohibition of x 
under condition a which, unless it is removed, it clashes with an explicit permission 
in P. 

Since IOL and Defeasible Logic are different logical systems, which were designed 
for very different purposes, it is difficult to compare them also in regard to the problem 
of permission. Despite any possible connection between the two logics, which is still 
an open research problem (Defeasible Logic in fact characterises a consequence relation 
falling within cumulative reasoning J7)), an immediate comparison shows significant 
differences. In particular, formulas in IOL are based on propositional logic while rules 
in Defeasible Logic are built using atomic literals, modal literals, and their negations. 
A second difference is that the inference machinery of IOL leads to derive pairs, while 
the inference output in Defeasible Logic refers to theories and consists of sets of tagged 
literals. 

However, there are some general similarities in both approaches. 

• First, Defeasible Logic, like IOL, models explicit and implicit permissions by dis- 
tinguishing in an analogous manner a consequence relation for obligation and one 
for permission. 

• Second, the definition of negative or weak permission in both formalisms is the same. 

9 1331 offers a different technical treatment, which is however in line with most intuitions discussed in 125191 . 
10 1331 proposed two definitions. Here, we report on the simpler one. 
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• Third, although we have not discussed in our approach the notion of static permis- 
sion, it seems relatively simple to capture it in Defeasible Logic: indeed, we may 
derive that some p is permitted by making an essential use in the derivation of a rule 
for explicit permission. The only feature that makes the difference with respect to 
Defeasible Logic is that in IOL static permission admits the principle "Ought implies 
Can", which does not hold for strong permission in our approach. 

Similarly, since both approaches distinguish between permissions rebutting obliga- 
tions and permissions providing exceptions, we do not see any difficulty in capturing in 
Defeasible Logic the intuition behind the concept of exemption, even though exceptions 
are more naturally captured in Defeasible Logic by using the superiority relation between 
rules. The concept of dynamic permission can be instead expressed in Defeasible Logic, 
but in a different way, due to the sceptical character of Defeasible Logic: if we add a pro- 
hibition for some p, which is incompatible with any rule for explicit permission (or even 
a defeater), then we cannot derive such a prohibition (unless it is stated to be stronger 
than any other rule), and so p is dynamically permitted. 

A novelty of our paper is the introduction of the new operator to express prefer- 
ences between explicit permissions. A somehow similar idea has been suggested (though 
with different purposes) by J9), where a preference relation among pairs (for obligations 
and permissions) was introduced. Technically, it is not clear if that approach can be re- 
framed in our setting. In fact, adopting that option in Defeasible Logic would not work, 
as the superiority relation in Defeasible Logic plays a role in the proof theory only in 
case of rule conflicts. A clear advantage of the current proposal is that it adopts a rich 
formal language where 

• modal operators can occur in the applicability conditions of rules (the inputs in IOL 
are always factual); 

• we have two ordering types between permissions: the one expressed by and the 
one induced by the superiority relation which applies to defeaters. 

To the best of our knowledge, there is no logical system having linear complexity 
with analogous normative reasoning capabilities. 
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A. Appendix 

We now prove the properties related to operations that transform a theory D into an 
equivalent simpler theory D' (we recall that the term "simpler" means a theory with a 
minor number of symbols in it). The transformations operate on rules either by removing 
some elements from some rules, or by deleting rules from a theory. Given the functional 
nature of the operations involved, we will refer to the rules in the target theory with the 
same names/labels as the rules in the source theory. Thus, given a rule r £ D, we will 
refer to the rule corresponding to it in D 1 ', if it exists, with the same label, namely r. 

Lemma 19. LetD = (F,R,>) be a theory such that p eFnLit Let D' = (F',R', >') be 
the theory obtained from D, where 

F' =F\{ P } 

R' ={r : A(r) \ {p} =^0 C(r)\p\r £ R,A{r) dp = 0}U 

{r : A{r) \ {p} =^ P C{r)\r £ R,A(r) Dp = 0} 
>'=>\{{r,s),(s,r)\r,seR,A(r)rip^<I)}. 

Then D = D' . 

Proof. The proof is by induction on the length of a derivation P. 

For the inductive base, we consider all the modal derivations for a generic literal q 
in the theory. 

P(l) = +doq. This is possible in two cases: (1) Oq £ F, or (2) O^q F, -^Oq g" F and 
Pr^q g F, and 3r £ R°[q, i] that is applicable for q at i at P(l) and every rule for ~q is 
either (a) discarded for ~q at P(l), or (b) defeated by a stronger rule for q applicable at 
P(l). 

For (1), by construction of D', Oq £ F iff Oq £ F' , thus +<9o<7 is provable both in D 
and in D 1 . 

For (2), again by construction of D', the modal literals in the clause do not appear in 
F iff they do not appear in F' . Furthermore, an obligation rule r £ R°[q 7 i] is applicable 
for q at P(l) iff ;' = 1, A(r) C F, and ~p £ A{r) since p £ F. Therefore A(r) C F if 
A{r) \ {p} C F', This means that if a rule is applicable at P(l) in D then it is applicable 
at P(l) in D'. In the other direction, suppose that r is applicable in D', thus in particular 
A(r) C F'. In both cases where r has p in its antecedent or it is not in D, we obtain 
A(r) C F, therefore r is applicable in D. 

Let us now consider a rule attacking r, namely a rule s £ R[~q,j]. For such a rule, 
we have to analyse cases (a) and (b) above. 
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(a) A rule s is discarded for ~q at j at P(l) in D iff: (i) 3a,- G A(i) n Lit and a, ^ F, 
or (ii) 3ck G k < j such that q G F, and 5 G by condition (2) of a rule 
being discarded for +<9<> 

For (i), we are sure that ci\ ^ p since p £ F by hypothesis. If a,- = ~p, then 5 is 
discarded in D and, by construction, the rule is not in D' . Hence R'[~q\ C If 
a, ^ ~p, then by construction a, ^ F iff a, ^ F'. For (ii), if c& = p, then the rule is 
discarded in D, the consequent of s is truncated at in D 1 , and does not occur in the 
consequent of s in D 1 , i.e., s £ R'[~q]. If e& ^ p, then the rule is also discarded in D' since 
the only difference between F and F' is that p is in F but not in F'. To summarise, if a 
rule is discarded for at j at P(l) in D, then the rule is either not in D' , or discarded in 
D' . 

For the other direction, in R' there are no rules containing either p, or ~p. Hence, if 
we have a,- € A (s) and a, ^ F', then a, ^ F. Similarly for q, if G F', then q G F. The 
difference between D and D' is that in R we have rules with ~p in the antecedent and 
rules with p preceding g in the consequent, and these rules are not in R'. Since p G F, all 
rules in R for which there is no corresponding rule in R' are discarded in D. 

(b) The superiority relation is modified in a way that we only remove instances 
where one of the rules is discarded in D. But only rules that are not discarded are active 
in the clauses of the proof conditions where the superiority relation is involved. 

From the discussion above, if a rule is applicable for q at 1 at F(l) in D, then the 
rule is also applicable in D'. If a rule is discarded for ~g at index 1 at F(l) in D, then the 
rule is not in D', or it is discarded in D'. If a rule s for ^q is applicable in D, then there 
is an applicable rule t for q stronger than s. The rules s and t are applicable, so they are 
in D' and t >' s. Thus, D' h +d q. 

Similarly to the other direction, if a rule is applicable in D' then it is applicable in D, 
and if it is discarded in D' then it is discarded in D. The additional rules in D have either 
~p in the antecedent, or p in the consequent, thus these rules are discarded in D, and for 
them clause (2.3.1) of +do applies. Therefore if we have a derivation of length one of 
+doq in D 1 ', then we have D h +doq- 

P(l) = +dpq. The proof is essentially identical to the inductive base for +doq, with 
some slight syntactical modifications dictated by the different proof conditions for +dp: 
(1) P<? G F, or (2) 0~<? g F and -Pq F, and 3r G R p [q, 1] that is applicable for q atP(l) 
and every obligation rule for ~q is either (a) discarded for ^q at P( 1 ), or (b) defeated by 
a stronger rule for q applicable at F(l). 

F(l) = —doq. Clearly clauses (1) and (2.1) of — do hold for D iff they hold forD', given 
that F and F' have the same modal literals. For clause (2.2), consider a rule r G R° [q. 1]. 
If r is discarded for D then, as we argued above, it is not in R', or it is discarded in D'. 
Also, all rules discarded in D' are discarded in D, and all rules in R for which there is no 
corresponding rule in R' are discarded in D as well. As regards clauses (2.3.1)-(2.3.3), 
we point out that condition t ^ s between two applicable rules t and s is clearly unaffected 
passing from D to D 1 ', and the other way around. 

F(l ) = —dpq. This case is a mere variant of the previous one for the negative provabil- 
ity of obligations. 

For the inductive step, the property of equivalence between D and D 1 is assumed up to 
the n-th step of a generic proof for a given literal /. 
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Pin + 1) = +doq. Clauses (1) and (2.1) of +do follow the same conditions treated in 
the inductive base for +doq. As regards clause (2.2), if an applicable rule r £ R°[q,i] 
for q in D exists, then clauses (1.1)— (1.5) and (2) of Definition [5] are all satisfied. By 
inductive hypothesis, we conclude that clauses (1 . 1)-(1 .4) are satisfied by r in D' as well, 
and clause (1.5) is satisfied in D' by the inductive base. For condition (2), the provability 
of Ck as an obligation in D' is given by inductive hypothesis; furthermore, c& F or 
^c<. £ F iff q g 1 F' or £ F' either when q. = ~/)orcj^~^ since F and F' coincide 
in both cases (notice that q ^ p by hypothesis). 

The direction from rule applicability in D' to rule applicability in D is straightfor- 
ward. Therefore, a rule r £ R°[q,i] is applicable for q in D iff it is applicable for q in 
D 1 . Conditions (2.3.1)-(2.3.3) are treated like cases (a) and (b) for the corresponding 
inductive base. 

Pin + 1) = +dpq. Again, the inductive base justifies clauses (1), (2.1), (2.3.1), and 
(2.3.2) of +dpq. Clause (2.2) is satisfied by the same reasoning used in the inductive 
step of +doq and by Definition [6] whose additional clause (3) is trivially satisfied by 
inductive hypothesis. 

Pin + 1) = —doq. Besides conditions (1), (2.1), (2.3.1), and (2.3.2) - treated as usual 
- it remains to prove that a rule for q as a permission at P(n + 1) is discarded in D iff 
it is discarded at P(n+ 1) in D'. To this end, we follow the same analysis carried out 
in P(n + 1) = +doq for rule applicability, using the inductive base and hypothesis, and 
Definition 13 

Pin + 1) = —dpq. This case is a mere variant of the previous one for the negative 
provability as an obligation. □ 

Lemma 20. Let D — (F,R, >) be a theory such that F n Lit = and D h +dop. Let 
D' = (F,R' , >') be the theory obtained from D where 

R' = {r : A(r) \ {Op} =^o C{r)\~p Q ~p, 
A{r) \ {Op} C(r) Q p\r £ R,A(r)r\6p = 0} U 
{r : A(r) \ {Op} ^ P C{r) Q ~p\r £ R,A(r)n6p = 0} 

>'=>\{ir,s),(s,r)\r,s£R,A(r)nOp^<D}- 

Then D = D'. 

Proof. The proof is by induction on the length of a derivation P. 

For the inductive base, we consider all possible derivations of length one for a 
generic literal q in the theory, where Op £ F. 

P(l) — +doq. From D to D\ the structure of the proof follows the inductive base for 
+doq of Lemma[T9l where the cases depending on F are trivially satisfied since F = F' , 
and the other steps are obtained by substituting p with Op and ~p with Op. 
From D' to D, there must exist an applicable rule r proving +doq at P(l) in D'. Then 
A{r) C F. By construction of D', the antecedent of r in D is either the same, or A(r) U 
{Op}, while the consequent has either q as the first element, or only p precedes q. Since 
Op £ F and p $ F, all the combinations of antecedent and consequent denote applicable 
rules in D. 
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As already argued, also in this case if a rule s is discarded at P(l) in D, then it 
is not in D' , or it is discarded in D' . In particular, all rules in R for which there is no 
corresponding rule in R' have either (i) -Op, O^p or P~p in the antecedent, or (ii) ~/> 
in the consequent. Since +dop holds, clause (1.2) of Definition [7] and Proposition IT31 
Parts Q] and [2] make the rules of the form (i) discarded in D. Rules of type (ii) are also 
discarded in D since Op £ F. 

P{n + 1) = +doq. The proof is essentially identical to situation P(n + 1) = +doq of 
Lemma [T9l Notice that for rule applicability, clauses I £ F (condition (1.5)), and £" F 
or ~q £ F (condition (2)) are both true in D and D', since the set of facts is the same 
and it does not contain non-modal literals. 

P(l) = +dpq, P(n + 1) = +dpq. For the inductive base, notice that by construction of 
D' ', the antecedent of a rule r for permission in D is either the same, or A(r) U {Op}, 
while the consequent has either q as the first element, or only ~p precedes q. However, 
applicability and refutability of this rule follow the analysis carried out for +9q- We treat 
the inductive step as usual, using the inductive hypothesis and the fact that F = F'. 

The hypothesis F = F' and the structure of D' can be easily used to prove the inductive 
base and the inductive step for proof tags — <?o and —dp. 

Both the inductive base and the inductive step for ±<9x<? with X = {0,P} in the case 
where Op ^ F are straightforward. Indeed, even when Op 6 A(r) in D, the hypothesis 
+dop allows an applicable rule in D' to be also applicable in D. The same hypothesis 
allows us to conclude that a discarded rule in D is also discarded in D', and the other way 
around. □ 

Lemma 21. Let D = (F,R, >) be a theory such that F (~l Lit = and D h — dop. Let 
D 1 = (F,R' , >') be theory obtained from D where 

R' = {r: A(r) \ {^Op} C(r)\p Q p\r £ R,A(r) n {Op} = 0} 

>' =>\{(r,s),(s,r)\r, S GR,A(r)n{Op}^®}. 

Then D = D'. 

Proof. Since D h +dol implies D h —do~l by Proposition [TBI Part [Tl the modifications 
on R' and >' represent a particular case of Lemma [20l where / = ^p. The only differ- 
ence is that we eliminate from D rules with Op in the antecedent, and we modify the 
antecedent of the others eliminating —Op (we recall that condition —dop makes -Op 
defeasibly proved in our framework). In the case that R°[p] = 0, no modifications on the 
consequent of rules are made since literal p does not appear in any chain by hypothe- 
sis. □ 

Lemma 22. Let D = (F,R,>) be a theory such that F n Lit = and D h +d P p. Let 
D 1 = (F,R' , >') be theory obtained from D where 

R' ={r : A(r) \ {Pp} =^0 C{r)\~p Q ~p|r £ R,A(r) DPp = 0}U 

{r : A(r) \ {Pp} ^ P C{r)\p\r £ R,A{r) C\Pp = 0} 

>'= >\{(r,s),(s,r)\r,s e R,A(r)nPp ^Q>}. 
Then D = D' . 
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Proof. The proof is by induction on the length of a derivation P; its structure is the 
same of that for Lemma [20] We have to take into account the different proof conditions 
for permission, and arrange the proof to analyse the inductive bases and steps of each 
derivation either when Pp is a fact or not. 

For the inductive base, we consider all possible derivations of length one for a 
generic literal q in the theory, where Pp £ F. 

P(l) — +doq. From D to D' , the structure of the proof follows the inductive base for 
+doq of Lemma[l9] where the cases depending on F are trivially satisfied since F = F', 
and the other steps are obtained by substituting p with Pp and ~/> with Pp. 
From D' to D, there must exist an applicable rule r proving +doq at P(l) in D'. Then 
A(r) C F. By construction of D', the antecedent of r in D is either the same, or A(r) U 
{Pp}, while the consequent has q as the first element. In this case p cannot precede q 
since a permission never precedes an obligation in a reparation chain. Since Pp £ F, then 
all rules in D corresponding to applicable rules in D' are themselves applicable in D. 

As already argued, also in this case if a rule s is discarded for ^q at P(l) in D, then 
either it is not in D 1 ', or it is discarded in D'. In particular, all rules in R for which there 
is no corresponding rule in R' have either (i) -Pp or O^p in the antecedent, (ii) ^p 
precedes ~q if s is an obligation rule, (iii) p precedes ^q if s is a permission rule. Since 
+o\>p holds, clauses (1.1) and (1.4) of Definition |7J and Proposition [TBI Part [31 make the 
rules of the form (i) discarded in D. Moreover, the rules of type (ii) and (iii) are also 
discarded since Pp £ F, and by Definition [7] clauses (2) and (3), respectively. 

P(n + 1) = +doq. The proof is essentially identical to situation P(n + 1) = +doq of 
Lemma [T9l Notice that for rule applicability, clauses / £ F (condition (1.5)) and c^^F 
or £ F (condition (2)) are both true in D and D', since the set of facts is the same 
and it does not contain non-modal literals. 

P(l) = +dpq, P(n + 1) = +dpq. For the inductive base, notice that by construction of 
D' ', the antecedent of a rule r for permission inD is either the same, or A(r) U {Pp}, while 
the consequent must have q as first element. However, applicability and refutability of 
this rule follow the analysis carried out for +3q. We treat the inductive step as usual, 
using the inductive hypothesis and the fact that F = F'. In this case, we do not consider 
rules of type (iii), i.e., rules for P~q, since only rules for obligation can attack rules for 
permission. 

The hypothesis F = F' and the structure of D' can be easily used to prove the inductive 
base and the inductive step for proof tags — <?o and — dp. 

Both the inductive base and the inductive step for ±dxq with X = {0,P} in the case 
where Pp g' F are straightforward. Indeed, even when Pp £ A(r) in D, the hypothesis 
+dpp allows an applicable rule in D' to be also applicable in D. The same hypothesis 
allows us to conclude that a discarded rule in D is also discarded in D', and the other way 
around. □ 

Lemma 23. Let D = (F.R, >) be a theory such that F n Lit = and D h —dpp. Let 
D 1 = (F,R' , >') be theory obtained from D where 

R' = {r: A(r) \ {-.Pp} ^ P C(r) Qp\re R,A(r) n {Pp} = 0} 

>' => \{(r,s),(s,r)\r,s £ R,A(r)n{Pp} ? 0}. 
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Then D = D'. 



Proof. Condition D h —dp^l is another consequence of D h +dol, as stated by Propo- 
sition[T5lPartl2l As such, the proof is derived by Lemmal20l where / = ~p. □ 

Lemma 25. Let D = (F,R,>) be a theory such that Fn ModLit = 0, 3r G 
A(r) = 0, C R infd . Then D h +<?oP- 

Proof. Given that there are no modal literals in F clause (2.1) of +<?o is satisfied. Let 
r be a rule that meets the conditions of the Lemma. According to Definition [5] rule r is 
trivially applicable for p in the condition for +do, and thus clause (2.2) is applicable as 
well. Finally, for clause (2.3) we have that all rules for ^p are inferiorly defeated by an 
appropriate rule with empty antecedent for p, but a rule with empty body is applicable. 
Hence, all clauses for proving +do are satisfied. Thus, D h +dop. □ 

Lemma 26. Let D = (F,R, >) be a theory such that F n ModLit = 0, 3r S ^ p [p, 1], 
A(r) = 0, and i?°[~p] C R infd . Then D h +<9pp. 

Proof. The proof is analogous to the previous one. The differences are that we have 
to use the notion of applicability in Definition [6] and that the rules that are inferiorly 
defeated are restricted to rules in R° . □ 

Lemma 27. Let D = (F,R,>) be a theory such that F n ModLit = andR x \p] = <d,for 
X G {0,P}. Then D h -d x p. 

Proof. If there are no modal literals and the set of defeasible (obigation/permission) rules 
for a literal p is empty, then clause (2.2) of —do and — dp are vacuously satisfied. □ 

Lemma 28. Let D = (F,R, >) be a theory such that F n ModLit = 0, and 3r e R[p 7 1] 
such that A (r) = and r sup = 0. Then 

1. ifr G R°, then D h -d n ~p, □ G {0,P}; 

2. i/re R p UR def , then D\--d ~p. 

Proof. Let r be a rule in a theory D for which the conditions of the Lemma hold. It is easy 
to verify that for both cases the rule satisfies clause (2.3) of —do, in particular (2.3.2-3) 
for — do and (2.3.2) for — dp. □ 
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